Sophos Firewall: v19.5 MR2: Feedback and experiences

We were waiting for the SSL VPN routing problem with static IP assigned to the client to be solved with MR2. Unfortunately it still is not solved. It got worse instead. After assigning a static SSL VPN IP to one client it cannot access the LAN network anymore. Connection is established but no traffic to LAN is possible. If we remove the static SSL VPN IP from the user everything works fine. But we need static IP so we can access the device from the LAN on FQDN. With MR1 we had the problem that the device could access the LAN with static IP assigned but traffic from LAN to the connected device was not possible because of routing problem in the XGS. Does anybody have the same problem and is there a solution? The issue ID for this is NC-114163.

Same problem here. Requests from the client are hitting the Sophos Firewall but replies are not routed in to the tunnel interface but to the WAN.



After deleting the static IP from the user settings everything works fine and replies are hitting the tunnel interface

Same problem here. Requests from the client are hitting the Sophos Firewall but replies are not routed in to the tunnel interface but to the WAN.



After deleting the static IP from the user settings everything works fine and replies are hitting the tunnel interface

Hello Marek,

Would it be possible for you to open a case with Support, reference this community post and the NC-114163.

Regards,

Case has been opened. Support Engineer pointed an easy way how to test this with the Route Lookup from the Sophos Firewall Diagnostics Tools:

Route to the static IP VPN client:

172.16.255.250 is located on the Port2
172.16.255.250 is reached through the router X.Y.Z.W

Route to the dynamic IP VPN client:

172.16.255.10 is located on the tun0
172.16.255.10 is not behind a router

Hello Marek,

Thank you, I cannot find the Case ID under your account; can you share it.

Regards,

Hello Marek,

Thank you for the Case ID, you shared via PM; I can see the case is already escalated to GES for further investigation and troubleshooting.

Regards,

I've seen similar cases, where routes to move traffic across tun0 were not automatically created in certain cases and were instead being sent out the default route. I specifically remember that I could only create the proper routes via the CLI but don't remember exactly why. But I do remember not seeing the expected routes when using the ""ip route show table all" CLI command.

In my case it was across some IPSec tunnels instead of SSL VPN connections, but there's overlap in how those are treated in a Sophos. I would compare the full routing tables when the user is connected with a static versus the same user connected with a dynamic. I didn't like creating my routes like that because they are difficult to find unless you already know they exist, but it did work 

Problem has been solved. In my case the root cause was the SD-WAN Route and its Traffic Selector where source network 172.16.255.0/24 and destination network object 'Any' were used in policy for traffic to the Internet.

After replacing the source network with system object '##ALL_SSLVPN_RW’ and replacing the destination network 'Any' with 'Internet IPv4 group’ it started to work properly. Finally only the traffic to Internet is routed to the gateway and return traffic is reaching the static IP VPN client via tun1 interface.